CVE-2026-59960
Received Received - Intake

Command Injection in Argos JavaScript SDK

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and getMergeBaseCommitSha() when hasRemoteContentAccess is false. The gitFetch() and gitMergeBase() functions in packages/core/src/ci-environment/git.ts interpolate these values into execSync() command strings executed by /bin/sh -c, so shell metacharacters in a pull-request branch name can execute arbitrary commands with the Argos upload process privileges on the CI runner. Successful exploitation can expose CI secrets, alter build artifacts, or compromise the runner. This issue is fixed in Argos core package version 6.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-59960
EUVD
EUVD-2026-77641

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
argos core to 6.2.1 (inc)
argos-ci core to 6.2.1 (exc)
argos-ci core 6.2.1
argos javascript *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-59960 is an OS Command Injection vulnerability in the @argos-ci/core npm package affecting versions 6.2.0 and below. Attacker-controlled CI branch or ref strings are passed directly into execSync() calls without sanitization, allowing shell metacharacters like $() to execute arbitrary commands on the CI runner.

Detection Guidance

To detect this vulnerability, check if your system uses @argos-ci/core package version 6.2.0 or below. Inspect package.json for dependencies and run npm list @argos-ci/core. If vulnerable, look for suspicious CI logs showing unexpected commands or artifacts from manipulated branch names.

Impact Analysis

This vulnerability can expose CI secrets, alter build artifacts, or compromise the CI runner. Attackers can manipulate branch names via pull requests or environment variables to execute malicious commands with the privileges of the Argos upload process.

Compliance Impact

This vulnerability could lead to exposure of sensitive CI secrets, compromise of build artifacts, or full CI runner takeover. Such breaches may result in unauthorized access to personal data, violating GDPR or HIPAA requirements for data protection and integrity.

Mitigation Strategies

Immediately update @argos-ci/core to version 6.2.1 or later. If updating is not possible, disable the Argos CI integration or restrict CI branch name manipulation. Review CI logs for signs of exploitation and revoke exposed secrets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59960. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart